How to detect if your webserver is hacked and get alerted
We all do our best to write excellent code and also keep our installations of popular open source tools like Wordpress, Joomla, Oscommerce, Drupal, phpmyadmin and all its plugins always updated to prevent any attack or hackers using known exploits on them. This article is not aimed at going through all those methods to help you secure your website BUT focuses on how to send you an alert once your website is hacked and running “hidden” code that you didnt write.
The problem
Once hackers get into your website either by exploiting known vulnerabilities in any of the installed programs OR by getting FTP access to your server, the first thing they usually do is to plant backdoor scripts to log them in again at a later date. They need some executable script on the server to gain access to MySQL passwords, installation passwords or even edit settings in your wordpress or other installations. We have also seen situations where the site was left largely unchanged except for malicious javascript code added to the bottom of the index.php or index.html files.
So in short the bad guys have taken over your server and running anything from a backdoor script or launching phishing attacks or sending tons of spam emails. You will not know that your server is hacked until you get blacklisted on spamhaus or your customers get redirected to some random site or worser still when you are contacted by ebay/paypal/some bank saying that your website is phisihing their customers. The problem is that we dont even have an idea that our site is hacked until it is too late or too embrassing.
Simple Solution - Website Change Detection System
We need a script on the server that detects any changes or to any executable file on the server or any new file on the server from HTML, JS, to PHP, ASP, Perl, Python files etc. If we generate a hash value of all our files and then compare them periodically, then we will be able to detect when our codebase has changed on the server.
These are the steps that our change detection system performs (It takes about 500ms to execute on a typical server):
- Load configuration file (contains password, exclude list)
- Check password from request before starting (recommended)
- Recursively run through every file and sub folder on the server within the current directory of the script.
- Generate a hash for each file and arrive at the master hash.
- Compare master hash with hash the user has and alert if different!
Notes:
- This script at this simple level is almost 100% fool proof in detecting changes to the codebaes give that the hacker or bots don’t know of websiteCDS presence.
- At this stage the script cannot detect SQL injection attacks and changes to code that are saved to the database.
- The users hash is not stored on the server at any time, the comparison with master hash can be done at cron script level or using siteup as discussed below.
We have the following code written in PHP but you can do the same with any other scripting language to perform similar checks. We have started the project under google code and is available here: PHP code for WebsiteCDS
See the readme file in the download for help with setup.
Different ways to automate the alert system
Method 1: Using our trusted cron job
A cron job can be setup to run the website CDS, compare the results with the last known valid hash and send out an email alert.
Method 2: With Siteup
Siteup is a free tool for windows systems that can be set to periodically check if your website is reachable. This is recommended for those of us who don’t want to setup a cron job. It can be downloaded here http://www.xequte.com/other/index.html#siteup We can use this to frequently call our change detection system and then use the siteup word search to check if the hash value is the same as what we have from our last codebase update. ( See screenshot )
NOTE: The project & code included is the first version of the change detection system and kindly submit your ideas and comments here or an issue or feature request in google code project for websitecds.
Follow us on twitter 
What is the best way to get to know which folder has the hacker’s code? What if I had this script on each and every sub folder on my server :)?
Nice tip!
One feature request - Can we find out which file has changed ?
please use something more than md5. generate multiple hashes so that they can be verified against the file. it won’t take too much more time than now.
you can change the md5 to sha1 or any other hash function you like.
This is a good mechanism to alert the user that something changed. Once you know that something has indeed changed, I would recommend using BeyondCompare or ECMerge or any other FTP to folder merge and comparison tools to see what has changed. This way you will be able to find out what file was hacked.
SO, you CAN use this as it is and alert you, but once alerted, use some comparison tool along with your original codebase!
Please see the link below for implementation that lists the files that were add, deleted or modified.
http://code.google.com/p/websitecds/issues/detail?id=4
Nice idea! Also note - Attackers directly inject the malicious code in your CMS database by SQL Injection or XSS attacks.
Also checkout TripWire. -Thanks!
sourceforge.net/projects/tripwire/
[...] happened to read a post on how to detect if someone has changed files on your webserver to serve nebulous scripts and what [...]
[...] Change Detection System Posted by Admin May - 7 - 2009 - Thursday I happened to read a post on how to detect if someone has changed files on your webserver to serve nebulous scripts and what [...]
Many people (such as myself) may not have any immediate alternative — and it’s definitely better than nothing. Thanks for the script.
Tripwire, AIDE, AFICK, Samhain are alternatives but require you to have complete control over your web server.
Thanks for the help! I’ve suggested it to my friends and colleagues. I’ve also referenced your article in my post. I’ve assumed the link is the way you want it. Keep up the great work!
Thanks again,
Ben
hmmm interesting little project, looking at some-point to implement something like this when I re-active my site. Shut it down due to getting compromised by a wordpress vulnerability that activated on my own PC when I went to view something on mysite - net result they got my FTP logins that resulted in over 50 different IP’s login each attempting to make a single file amend.
So shut it all down - managed to nip it in the bud early.
Easy tell tale sign of file change is the Date
it not often when you have a site up and running that you amend the files so a compromised account will harbour a date newer than when you uploaded.
Worthwhile using that sort of functionality to pick out altered files.
Thanks for sharing the code. This is a script via a cron job to alert you for file changes. Something like the oscommerce site monitor contribution I guess.
If you your server was hacked in the past you should not only restore from backups and change passwords, but figure out how they got in and fix the code. (You have the host’s server logs that should give you clues). As per the google code for the project the top request is to find out which file has changed. That will be a good enhancement. I hope someone will be able to do that for me
Atleast this is a great solution to figure out if someone has tampered with any code on my site!
Thanks for the detailed post!